windowsevent

README

How to setup a windows eventlog dev environment

Cross compilation from mac is not easy, an easier path is to use a linux vm for that (for instance ubuntu/trusty64 vagrant vm). Requirements are to install go 1.11+, and to install mingw-w64 with apt.

Once those requirements are met, to build, run:

GOOS=windows CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -mod=mod -tags "log" -o ./DataDog/datadog-agent/bin/agent/agent github.com/DataDog/datadog-agent/cmd/agent

The binary can then be run in a windows vm, for instance opentable/win-2012r2-standard-amd64-nocm:

agent.exe start -c agent-conf\datadog.yaml

Documentation

Index

• func EnumerateChannels() ([]string, error)
• func Identifier(channelPath, query string) string
• type Config
• type Launcher
  • func NewLauncher(sources *config.LogSources, pipelineProvider pipeline.Provider) *Launcher
  • func (l *Launcher) Start()
  • func (l *Launcher) Stop()
• type Tailer
  • func NewTailer(source *config.LogSource, config *Config, outputChan chan *message.Message) *Tailer
  • func (t *Tailer) Identifier() string
  • func (t *Tailer) Start()
  • func (t *Tailer) Stop()

Functions

func EnumerateChannels

func EnumerateChannels() ([]string, error)

EnumerateChannels does nothing

func Identifier

func Identifier(channelPath, query string) string

Identifier returns a string that uniquely identifies a source

Types

type Config

type Config struct {
	ChannelPath string
	Query       string
}

Config is a event log tailer configuration

type Launcher

type Launcher struct {
	// contains filtered or unexported fields
}

Launcher is in charge of starting and stopping windows event logs tailers

func NewLauncher

func NewLauncher(sources *config.LogSources, pipelineProvider pipeline.Provider) *Launcher

NewLauncher returns a new Launcher.

func (*Launcher) Start

func (l *Launcher) Start()

Start starts the launcher.

func (*Launcher) Stop

func (l *Launcher) Stop()

Stop stops all active tailers

type Tailer

type Tailer struct {
	// contains filtered or unexported fields
}

Tailer collects logs from event log.

func NewTailer

func NewTailer(source *config.LogSource, config *Config, outputChan chan *message.Message) *Tailer

NewTailer returns a new tailer.

func (*Tailer) Identifier

func (t *Tailer) Identifier() string

Identifier returns a string that uniquely identifies a source

func (*Tailer) Start

func (t *Tailer) Start()

Start does not do much

func (*Tailer) Stop

func (t *Tailer) Stop()

Stop stops the tailer